zeertzjq
40fb2818b6
vim-patch:9.1.2085: Use-after-free in winframe_remove()
...
Problem: Use-after-free in winframe_remove() (henices)
Solution: Set window_layout_locked() inside winframe_remove()
and check that writing diff files is disallowed when the
window layout is locked.
It can happen with a custom diff expression when removing a window:
1. Buffer was removed, so win_frame_remove() is called to remove the
window.
2. win_frame_remove() → frame_new_height() → scroll_to_fraction()
→ diff_check_fill() (checks for filler lines)
3. diff_check_fill() ends up causing a diff_try_update, and because we
are not using internal diff, it has to first write the file to a
buffer using buf_write()
4. buf_write() is called for a buffer that is not contained within a
window, so it first calls aucmd_prepbuf() to create a new temporary
window before writing the buffer and then later calls
aucmd_restbuf(), which restores the previous window layout, calling
winframe_remove() again, which will free the window/frame structure,
eventually freeing stuff that will still be accessed at step 2.
closes : vim/vim#19064
ead1dda74a
Nvim doesn't have this bug as Nvim uses a floating window as autocommand
window, and removing it doesn't need winframe_remove().
Co-authored-by: Christian Brabandt <cb@256bit.org >
2026-01-14 13:56:01 +08:00
..
2026-01-10 05:49:46 +00:00
2026-01-12 00:33:19 +00:00
2026-01-13 09:41:51 +01:00
2025-08-14 09:34:38 +02:00
2025-12-30 01:44:24 -05:00
2026-01-11 20:04:32 +08:00
2026-01-07 08:11:42 +08:00
2025-11-19 20:43:15 -08:00
2026-01-08 07:49:42 +08:00
2025-08-14 09:34:38 +02:00
2026-01-12 03:50:57 +00:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-10-13 00:17:39 -04:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-12-07 15:13:31 -05:00
2025-12-07 15:13:31 -05:00
2025-12-28 14:26:29 +08:00
2025-12-07 15:13:31 -05:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-12-28 08:14:45 +08:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2026-01-14 13:56:01 +08:00
2025-08-14 09:34:38 +02:00
2026-01-09 11:54:22 +08:00
2025-08-14 09:34:38 +02:00
2026-01-01 01:58:02 -05:00
2025-08-14 09:34:38 +02:00
2026-01-12 00:33:19 +00:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-10-14 05:04:37 +00:00
2025-09-29 07:02:01 -07:00
2025-12-30 01:44:52 -05:00
2025-12-21 21:17:33 -05:00
2025-12-30 01:44:24 -05:00
2025-09-08 09:02:37 +08:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-12-20 22:07:27 -05:00
2025-08-14 09:34:38 +02:00
2025-12-02 07:24:28 +08:00
2025-08-14 09:34:38 +02:00
2025-09-09 12:56:49 +02:00
2026-01-01 01:48:49 -05:00
2025-08-14 09:34:38 +02:00
2025-10-11 09:22:18 -07:00
2025-09-09 12:56:49 +02:00
2026-01-14 13:56:01 +08:00
2025-08-14 09:34:38 +02:00
2025-08-17 08:52:05 +08:00
2025-08-14 09:34:38 +02:00
2025-12-20 22:07:27 -05:00
2025-08-14 09:34:38 +02:00
2026-01-01 01:48:49 -05:00
2025-08-14 09:34:38 +02:00
2025-12-25 15:38:45 +08:00
2025-08-14 09:34:38 +02:00
2026-01-14 13:56:00 +08:00
2025-11-02 18:07:33 +08:00
2026-01-01 01:48:49 -05:00
2025-10-26 06:20:33 +08:00
2026-01-03 23:46:15 +00:00
2025-09-23 13:35:08 -07:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2026-01-10 08:25:49 +08:00
2025-08-14 09:34:38 +02:00
2026-01-03 09:41:38 +08:00
2026-01-14 13:56:00 +08:00
2025-08-14 09:34:38 +02:00
2025-01-07 09:15:10 +08:00
2025-10-04 04:28:30 +00:00
2025-08-14 09:34:38 +02:00
2025-01-02 05:51:03 -08:00
2026-01-01 01:48:49 -05:00
2025-08-14 09:34:38 +02:00
2026-01-10 14:28:45 +00:00
2025-08-14 09:34:38 +02:00
2026-01-02 02:17:57 -05:00
2025-08-14 09:34:38 +02:00
2026-01-04 19:36:35 +08:00
2025-08-14 09:34:38 +02:00
2026-01-09 11:54:22 +08:00
2025-08-14 09:34:38 +02:00
2025-12-14 09:28:13 +08:00
2025-08-14 09:34:38 +02:00
2025-02-26 16:54:37 +00:00
2025-08-18 11:03:08 +08:00
2025-08-14 09:34:38 +02:00
2025-08-27 10:17:12 +08:00
2025-08-14 09:34:38 +02:00
2024-11-16 09:55:41 +08:00
2025-12-29 07:56:45 +08:00
2025-08-14 09:34:38 +02:00
2025-10-08 06:29:00 +08:00
2025-04-28 10:10:11 +02:00
2025-12-15 13:55:15 -05:00
2025-10-10 07:14:50 -07:00
2025-08-31 05:29:43 +00:00
2025-08-14 09:34:38 +02:00
2025-09-12 07:32:42 +08:00
2025-08-14 09:34:38 +02:00
2025-10-10 07:14:50 -07:00
2026-01-09 11:52:59 +00:00
2025-08-14 09:34:38 +02:00
2025-10-14 18:48:27 -07:00
2025-10-10 07:14:50 -07:00
2025-12-24 09:43:42 +08:00
2025-08-14 09:34:38 +02:00
2025-10-04 04:28:30 +00:00
2025-08-14 09:34:38 +02:00
2025-10-14 08:46:54 +08:00
2025-08-14 09:34:38 +02:00
2026-01-10 07:07:24 +08:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-03-08 05:45:39 +08:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-10-04 04:28:30 +00:00
2025-08-14 09:34:38 +02:00
2025-05-02 09:28:50 +02:00
2025-12-28 14:26:29 +08:00
2025-08-14 09:34:38 +02:00
2024-07-30 07:35:25 +08:00
2026-01-08 09:59:27 +08:00
2025-08-14 09:34:38 +02:00
2025-10-25 06:48:04 +08:00
2025-12-07 15:13:31 -05:00
2025-08-14 09:34:38 +02:00
2025-02-25 13:09:01 +01:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2026-01-05 14:11:31 +08:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-01-13 13:16:41 +01:00
2025-09-22 07:30:00 +08:00
2025-08-14 09:34:38 +02:00
2024-08-08 08:11:53 +00:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-12-25 15:38:45 +08:00
2025-12-25 15:38:45 +08:00
2025-08-20 21:45:49 -04:00
2024-06-11 11:11:38 +02:00
2025-12-07 15:13:31 -05:00
2025-08-14 09:34:38 +02:00
2025-10-05 10:46:10 -04:00
2025-08-14 09:34:38 +02:00
2025-08-26 13:48:53 -07:00
2025-12-20 18:38:11 -05:00
2025-08-14 09:34:38 +02:00
2025-09-26 00:29:40 -04:00
2025-08-14 09:34:38 +02:00
2026-01-01 01:48:49 -05:00
2025-08-14 09:34:38 +02:00
2024-11-04 13:12:33 +01:00
2026-01-01 01:48:49 -05:00
2025-08-14 09:34:38 +02:00
2025-12-28 07:01:45 +08:00
2025-09-26 00:29:40 -04:00
2025-08-14 09:34:38 +02:00
2025-11-28 10:10:31 +08:00
2026-01-09 11:52:59 +00:00
2025-08-14 09:34:38 +02:00
2026-01-12 03:50:57 +00:00
2025-11-28 10:10:31 +08:00
2025-08-14 09:34:38 +02:00
2026-01-04 19:36:35 +08:00
2025-08-14 09:34:38 +02:00
2025-11-21 08:02:20 +08:00
2025-08-14 09:34:38 +02:00
2026-01-10 16:31:01 +08:00
2025-10-10 07:14:50 -07:00
2025-10-04 04:28:30 +00:00
2025-08-14 09:34:38 +02:00
2026-01-12 07:04:36 +08:00
2025-08-14 09:34:38 +02:00
2025-11-16 20:36:07 -08:00
2026-01-05 14:11:31 +08:00
2025-08-14 09:34:38 +02:00
2025-09-26 00:29:40 -04:00
2026-01-03 01:54:12 +00:00
2025-09-26 00:29:40 -04:00
2025-02-25 23:40:21 +00:00
2026-01-07 20:20:53 -05:00
2025-12-28 14:26:29 +08:00
2026-01-10 08:03:10 +08:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-10-05 10:46:10 -04:00
2025-08-14 09:34:38 +02:00
2024-07-07 07:21:14 +08:00
2026-01-05 14:11:31 +08:00
2025-08-14 09:34:38 +02:00
2025-12-15 14:01:27 -05:00
2025-08-14 09:34:38 +02:00
2026-01-05 14:11:31 +08:00
2025-08-14 09:34:38 +02:00
2025-10-05 10:46:10 -04:00
2025-08-14 09:34:38 +02:00
2025-06-09 18:57:28 +02:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-01-23 17:26:10 +01:00
2025-12-26 08:30:21 +08:00
2025-09-13 13:34:58 -07:00
2025-12-12 08:14:58 +08:00
2025-08-14 09:34:38 +02:00
2025-10-04 04:28:30 +00:00
2025-08-14 09:34:38 +02:00
2025-12-20 18:38:11 -05:00
2025-08-14 09:34:38 +02:00
2026-01-08 07:49:42 +08:00
2025-08-14 09:34:38 +02:00
2025-10-04 04:28:30 +00:00
2025-08-14 09:34:38 +02:00
2025-10-04 04:28:30 +00:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-05-01 10:06:08 -05:00
2025-08-14 09:34:38 +02:00
2025-08-14 09:34:38 +02:00
2025-10-26 06:18:13 +08:00
2025-08-14 09:34:38 +02:00
2025-09-13 14:57:04 -07:00
2025-08-14 09:34:38 +02:00
2025-09-13 22:49:50 -04:00
2025-12-02 10:51:22 -05:00
2025-08-14 09:34:38 +02:00
2026-01-02 08:21:55 +08:00
2025-08-14 09:34:38 +02:00
2025-12-06 20:33:02 -05:00
2025-08-14 09:34:38 +02:00
2026-01-02 00:27:35 -05:00
2025-12-01 02:34:51 -05:00
2025-11-19 20:43:15 -08:00
2025-12-16 12:55:32 +08:00
2026-01-14 13:56:01 +08:00
2025-12-21 10:41:53 +08:00
2026-01-10 16:31:01 +08:00
2025-08-14 09:34:38 +02:00